oscap-podman creates invalid ARFs

[jan-cerny]

Description of Problem:

I have a problem that oscap-podman creates invalid ARFs.

This is a problem because openscap-report can't process invalid ARFs.

OpenSCAP Version:

openscap-1.4.0-1.fc40.x86_64
scap-security-guide-0.1.74-1.fc40.noarch

Operating System & Version:

F 40

Steps to Reproduce:

1. sudo oscap-podman centos:stream9 xccdf eval --profile stig --results-arf /tmp/arf.xml /usr/share/xml/scap/ssg/content/ssg-cs9-ds.xml

Actual Results:

The <ai:hostname> element in the produced ARF file is empty.

Expected Results:

The <ai:hostname> element in the produced ARF file isn't empty.

Additional Information / Debugging Steps:

No

[ggbecker]

Isn't the case that "oscap" command is generating an invalid ARF instead, because oscap-podman is just a wrapper. So we should rather look into oscap behavior when scanning a container.

Maybe OpenSCAP doesn't know what to put into that field when there is not a valid hostname (probably because it's a container), and puts nothing instead.

[ggbecker]

Maybe the gethostname function is returning an empty string, which then is considered valid by the code (is not NULL):

openscap/src/XCCDF/result.c

Line 315 in 97d8831

if (gethostname(hname, _POSIX_HOST_NAME_MAX)) {